CVE-2025-32433 Detection

Author: te0rwx
Created: 2025-08-27 (Upt. 2026-08-16)

Description

A custom YARA rule for detecting known artifacts associated with CVE-2025-32433, an Erlang/OTP SSH pre-authentication remote code execution (RCE) vulnerability.

The rule was developed and validated against public proof-of-concept (PoC) artifacts and controlled lab-generated network captures.

Detection Coverage

This rule detects known indicators associated with CVE-2025-32433, including:

• Public PoC artifacts
• Erlang command execution (os:cmd())
• Erlang file write operations (file:write_file())
• SSH protocol and channel request indicators
• Erlang/OTP SSH banners
• Common exploit payload patterns
• Scanner artifacts associated with CVE-2025-32433

To reduce false positives, the rule requires multiple related indicators before producing a match.

Usage

yara -r rule-cve-2025-32433_v5.yar /path/to/scan

Validation

The rule was tested against:

• Public CVE-2025-32433 proof-of-concept artifacts
• Controlled laboratory network captures (PCAP/PCAPNG)
• Benign samples to verify detection specificity

Disclaimer

This rule is intended for defensive security research and detection engineering. It detects known exploitation artifacts and should not be considered a comprehensive detector for every possible exploit implementation or variant.